Brief Description: Monitoring personal information collected by state agencies.

Sponsors: Senators Kline, Fairley, Franklin and Keiser.

Hearing Date: 3/27/07

Staff: Colleen Kerr (786-7168).

Background:

The Department of Information Services (Department) was created to provide coordinated planning and management of state information services. The Washington State Information Services Board (Board) was created to provide direction to state agencies on strategic planning and technical policies for information services, to develop acquisition standards, and to assist agencies in acquiring and implementing information services.

The Department's duties include reviewing agency information technology portfolios; implementing statewide and interagency policies, standards, and guidelines; making information services available to state agencies, local governments, and public benefit nonprofit corporations on a full cost-recovery basis; establishing rates and fees for services provided by the Department; and performing all duties delegated to it by the Board.

Summary of Bill:

The Department of Information Services (Department) must create and maintain a registry of information systems maintained by state agencies that contain personally identifiable information. The registry must contain at least the following information about each information technology system used to conduct official public business:

• the name of the agency responsible for the system;
• the name of the system;
• the number of records stored in the system;
• the statutory authorization to collect the information;
• the personally identifiable information stored in the system;
• the methods by which information is collected or updated;
• the retention schedule; and
• the number of system interfaces.

The registry is not required to include systems that contain personally identifiable information pertaining solely to public officials acting in their official capacity.

Personally identifiable information is defined as information that can be associated with a particular natural person through one or more identifiers or other information. Official public business is defined as any legally authorized transaction or communication between a state agency and federal government, another state agency, tribes, or local governments, or between a state agency, tribe, or local government and a private person or entity.

Appropriation: None.

Fiscal Note: Requested on 3/22/07.

Effective Date: The bill takes effect 90 days after adjournment of session in which bill is passed.